CVE-2026-56191 CRITICAL

CVE-2026-56191: Microsoft Exchange Online Tampering Vulnerability

Vendor Microsoft

Product Microsoft Exchange Online

Weakness CWE-287 · Improper authentication

Published July 24, 2026

Last update July 24, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

What the vulnerability does

01Description

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.

Key dates

02Disclosure timeline

July 24, 2026 CVE published

July 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-56191 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html AskarLabs — CWE-287 write-up Improper Authentication

Related vulnerabilities

04Related CVE

CVE-2023-51478 WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability CVE-2023-47189 WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerability CVE-2023-48747 WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification Vulnerability CVE-2026-2991 KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token CVE-2026-8994 Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter